buildkite-agent start
The Buildkite agent's start command is used to manually start an agent and register it with Buildkite.
Starting an agent
Usage
buildkite-agent start [options...]
Description
When a job is ready to run it will call the "bootstrap-script" and pass it all the environment variables required for the job to run. This script is responsible for checking out the code, and running the actual build script defined in the pipeline.
The agent will run any jobs within a PTY (pseudo terminal) if available.
Example
$ buildkite-agent start --token xxx
Options
--no-color #
|
Don't show colors in logging (default: false) |
|---|---|
--debug #
|
Enable debug mode. Synonym for |
--log-level string #
|
Set the log level for the agent, making logging more or less verbose. Defaults to notice. Allowed values are: debug, info, error, warn, fatal (default: "notice") |
--experiment string #
|
Enable experimental features within the buildkite-agent |
--profile string #
|
Enable a profiling mode, either cpu, memory, mutex or block |
--config string #
|
Path to a configuration file |
--name string #
|
The name of the agent |
--priority string #
|
The priority of the agent (higher priorities are assigned work first) |
--acquire-job string #
|
Start this agent and only run the specified job, disconnecting after it's finished |
--reflect-exit-status #
|
When used with --acquire-job, causes the agent to exit with the same exit status as the job (default: false) |
--disconnect-after-job #
|
Disconnect the agent after running exactly one job. When used in conjunction with the |
--disconnect-after-idle-timeout int #
|
The maximum idle time in seconds to wait for a job before disconnecting. The default of 0 means no timeout (default: 0) |
--disconnect-after-uptime int #
|
The maximum uptime in seconds before the agent stops accepting new jobs and shuts down after any running jobs complete. The default of 0 means no timeout (default: 0) |
--cancel-signal-timeout duration #
|
The amount of time given to a subprocess to handle the cancel signal before SIGKILL is sent (default: 10s) |
--enable-job-log-tmpfile #
|
Store the job logs in a temporary file |
--job-log-path string #
|
Location to store job logs created by configuring |
--write-job-logs-to-stdout #
|
Writes job logs to the agent process' stdout. This simplifies log collection if running agents in Docker (default: false) |
--job-logs-otlp #
|
Export job logs directly as OpenTelemetry log records using the OTEL_EXPORTER_OTLP_LOGS_* / OTEL_EXPORTER_OTLP_* environment configuration (default: false) |
--shell string #
|
The shell command used to interpret build commands, e.g /bin/bash -e -c (default: "/bin/bash -e -c") |
--hooks-shell string #
|
The shell command used to interpret hooks commands, e.g pwsh -Command |
--queue string #
|
The queue the agent will listen to for jobs. If not set, the agent will use the default queue. Overwrites the queue tag in the agent's tags |
--tags string #
|
A comma-separated list of tags for the agent (for example, "linux" or "mac,xcode=8") |
--tags-from-host #
|
Include tags from the host (hostname, machine-id, os) (default: false) |
--tags-from-ec2-meta-data #
|
Include the default set of host EC2 meta-data as tags (instance-id, instance-type, ami-id, and instance-life-cycle) |
--tags-from-ec2-meta-data-paths string #
|
Include additional tags fetched from EC2 meta-data using tag & path suffix pairs, e.g "tag_name=path/to/value" |
--tags-from-ec2-tags #
|
Include the host's EC2 tags as tags (default: false) |
--tags-from-ecs-meta-data #
|
Include the host's ECS meta-data as tags (container-name, image, and task-arn) (default: false) |
--tags-from-gcp-meta-data #
|
Include the default set of host Google Cloud instance meta-data as tags (instance-id, machine-type, preemptible, project-id, region, and zone) |
--tags-from-gcp-meta-data-paths string #
|
Include additional tags fetched from Google Cloud instance meta-data using tag & path suffix pairs, e.g "tag_name=path/to/value" |
--tags-from-gcp-labels #
|
Include the host's Google Cloud instance labels as tags (default: false) |
--wait-for-ec2-tags-timeout duration #
|
The amount of time to wait for tags from EC2 before proceeding (default: 10s) |
--wait-for-ec2-meta-data-timeout duration #
|
The amount of time to wait for meta-data from EC2 before proceeding (default: 10s) |
--wait-for-ecs-meta-data-timeout duration #
|
The amount of time to wait for meta-data from ECS before proceeding (default: 10s) |
--wait-for-gcp-labels-timeout duration #
|
The amount of time to wait for labels from GCP before proceeding (default: 10s) |
--fail-on-missing-tags #
|
Exit the agent with an error if any enabled cloud tag source (EC2, ECS, GCP) fails to return tags (default: false) |
--skip-checkout #
|
Skip the git checkout phase entirely |
--checkout-override-mode string #
|
Controls which sources may override the agent's checkout settings; one of [strict from-job none]. |
--git-checkout-flags string #
|
Flags to pass to "git checkout" command (default: "-f") |
--git-clone-flags string #
|
Flags to pass to "git clone" command (default: "-v") |
--git-clean-flags string #
|
Flags to pass to "git clean" command (default: "-ffxdq") |
--git-commit-verification string #
|
Verify that the commit being built exists on the specified branch; one of strict or off (default: "strict") |
--git-fetch-flags string #
|
Flags to pass to "git fetch" command (default: "-v --prune") |
--git-sparse-checkout-paths string #
|
Comma-separated list of paths for git sparse checkout. When set, only the listed paths are materialized in the working tree. Paths are interpreted according to --git-sparse-checkout-mode. |
--git-sparse-checkout-mode string #
|
Changes how the sparse checkout paths are interpreted; available modes are [cone no-cone]. |
--git-clone-mirror-flags string #
|
Flags to pass to "git clone" command when mirroring (default: "-v") |
--git-mirrors-path string #
|
Path to where mirrors of git repositories are stored |
--git-mirror-checkout-mode string #
|
Changes how clones of a mirror are made; available modes are [dissociate reference]. In |
--git-mirrors-lock-timeout int #
|
Seconds to lock a git mirror during clone, should exceed your longest checkout (default: 300) |
--git-mirrors-skip-update #
|
Skip updating the Git mirror (default: false) |
--git-checkout-timeout int #
|
Seconds to allow for each git checkout attempt before it is killed and retried (0 means no timeout) (default: 0) |
--git-submodule-clone-config string #
|
Comma separated key=value git config pairs applied before git submodule clone commands such as |
--git-skip-fetch-existing-commits #
|
Skip git fetch if the commit already exists in the local git directory (default: false) |
--checkout-attempts int #
|
Number of checkout attempts (including the initial attempt). Failed attempts are retried with exponential backoff (factor of 2, starting at 1s: 1s, 2s, 4s, ...) (default: 6) |
--bootstrap-script string #
|
The command that is executed for bootstrapping a job, defaults to the bootstrap sub-command of this binary |
--build-path string #
|
Path to where the builds will run from |
--hooks-path string #
|
Directory where the hook scripts are found |
--additional-hooks-paths string #
|
Additional directories to look for agent hooks |
--sockets-path string #
|
Directory where the agent will place sockets (default: "$HOME/.buildkite-agent/sockets") |
--plugins-path string #
|
Directory where the plugins are saved to |
--health-check-addr string #
|
Start an HTTP server on this addr:port that returns whether the agent is healthy, disabled by default |
--no-pty #
|
Do not run jobs within a pseudo terminal (default: false) |
--no-ssh-keyscan #
|
Require known SSH host keys for the default checkout instead of accepting new keys (default: false) |
--no-command-eval #
|
Don't allow this agent to run arbitrary console commands, including plugins; also forces checkout-override-mode to 'strict' (default: false) |
--no-plugins #
|
Don't allow this agent to load plugins (default: false) |
--no-plugin-validation #
|
Don't validate plugin configuration and requirements (default: true) |
--plugins-always-clone-fresh #
|
Always make a new clone of plugin source, even if already present (default: false) |
--no-local-hooks #
|
Don't allow local hooks to be run from checked out repositories (default: false) |
--no-git-submodules #
|
Don't automatically checkout git submodules (default: false) |
--no-feature-reporting #
|
Disables sending a list of enabled features back to the Buildkite mothership. We use this information to measure feature usage, but if you're not comfortable sharing that information then that's totally okay :) (default: false) |
--allowed-repositories string #
|
A comma-separated list of regular expressions representing repositories the agent is allowed to clone (for example, "^git@github.com:buildkite/.*" or "^https://github.com/buildkite/.*") |
--enable-environment-variable-allowlist #
|
Only run jobs where all environment variables are allowed by the allowed-environment-variables option, or have been set by Buildkite (default: false) |
--allowed-environment-variables string #
|
A comma-separated list of regular expressions representing environment variables the agent will pass to jobs (for example, "^MYAPP_.*$"). Environment variables set by Buildkite will always be allowed. Requires --enable-environment-variable-allowlist to be set |
--allowed-plugins string #
|
A comma-separated list of regular expressions representing plugins the agent is allowed to use (for example, "^buildkite-plugins/.*$" or "^/var/lib/buildkite-plugins/.*") |
--opentelemetry-metrics #
|
Enable agent metrics export over OpenTelemetry OTLP. Configure OTLP with standard OTEL_EXPORTER_OTLP_* env vars (default: false) |
--log-format string #
|
The format to use for the logger output (default: "text") |
--spawn int #
|
The number of agents to spawn in parallel (mutually exclusive with --spawn-per-cpu) (default: 1) |
--spawn-per-cpu int #
|
The number of agents to spawn per cpu in parallel (mutually exclusive with --spawn) (default: 0) |
--spawn-with-priority string #
|
Assign priorities to every spawned agent (when using --spawn or --spawn-per-cpu). Pass "static" (the configured --priority for every agent, or no priority if unset), "ascending" (1, 2, 3, ...), or "descending" (-1, -2, -3, ...). Descending helps jobs be assigned across all hosts when the value of --spawn varies between hosts (default: "static") |
--cancel-signal string #
|
The signal to use for cancellation (default: "SIGTERM") |
--cancel-cleanup-timeout duration #
|
Extra time for a stopping agent to upload logs and artifacts after a job process exits or is killed, before the agent forcefully exits (default: 5s) |
--opentelemetry-tracing #
|
Enable tracing for build jobs with OpenTelemetry OTLP. Configure OTLP with standard OTEL_EXPORTER_OTLP_* env vars (default: false) |
--telemetry-service-name string #
|
Service name to use when reporting telemetry. (default: "buildkite-agent") |
--verification-jwks-file string #
|
Path to a file containing a JSON Web Key Set (JWKS), used to verify job signatures. |
--signing-jwks-file string #
|
Path to a file containing a signing key. Passing this flag enables pipeline signing for all pipelines uploaded by this agent. For hmac-sha256, the raw file content is used as the shared key. When using Docker containers to upload pipeline steps dynamically, use environment variable propagation (for example, "docker run -e BUILDKITE_AGENT_JWKS_FILE") to allow all steps within the pipeline to be signed. |
--signing-jwks-key-id string #
|
The JWKS key ID to use when signing the pipeline. If omitted, and the signing JWKS contains only one key, that key will be used. |
--signing-aws-kms-key string #
|
The KMS KMS key ID, or key alias used when signing and verifying the pipeline. |
--signing-gcp-kms-key string #
|
The GCP KMS key resource name used when signing and verifying the pipeline. Format: projects/*/locations/*/keyRings/*/cryptoKeys/*/cryptoKeyVersions/* |
--debug-signing #
|
Enable debug logging for pipeline signing. This can potentially leak secrets to the logs as it prints each step in full before signing. Requires debug logging to be enabled (default: false) |
--verification-failure-behavior string #
|
The behavior when a job is received without a valid verifiable signature (without a signature, with an invalid signature, or with a signature that fails verification). One of: [block warn]. Defaults to block (default: "block") |
--disable-warnings-for string #
|
A list of warning IDs to disable |
--ping-mode string #
|
Selects available protocols for dispatching work to this agent. One of auto (default, prefer streaming, but fall back to polling when necessary), poll-only, or stream-only. (default: "auto") |
--token string #
|
Your agent token. Prefix with file:// to read the token from a file, or fd:// to read it from an inherited file descriptor |
--endpoint string #
|
The Agent API endpoint (default: "https://agent-edge.buildkite.com/v3") |
--no-http2 #
|
Disable HTTP2 when communicating with the Agent API (default: false) |
--debug-http #
|
Enable HTTP debug mode, which dumps all request and response bodies to the log (default: false) |
--trace-http #
|
Enable HTTP trace mode, which logs timings for each HTTP request. Timings are logged at the debug level unless a request fails at the network level in which case they are logged at the error level (default: false) |
--kubernetes-exec #
|
This is intended to be used only by the Buildkite k8s stack (github.com/buildkite/agent-stack-k8s); it enables a Unix socket for transporting logs and exit statuses between containers in a pod (default: false) |
--kubernetes-container-start-timeout duration #
|
Timeout for waiting for all containers to start in a Kubernetes pod (default: 5m) (default: 5m0s) |
--job-context-dir string #
|
The directory for files the agent uses to coordinate with the processes running the job: the job env files, the job timeout marker file, and, in Kubernetes mode, the coordination socket (buildkite.sock). With agent-stack-k8s, leave this unset: the stack manages the shared /workspace volume that Kubernetes mode defaults to. When running --kubernetes-exec under your own orchestration, set this on every container to the path where the shared volume is mounted in that container. Outside Kubernetes mode it defaults to the system temporary directory and rarely needs changing |
--redacted-vars string #
|
Pattern of environment variable names containing sensitive values (default: "*_PASSWORD", "*_SECRET", "*_TOKEN", "*_PRIVATE_KEY", "*_SSH_KEY", "*_ACCESS_KEY", "*_SECRET_KEY", "*_CONNECTION_STRING", "*_API_KEY") |
--strict-single-hooks #
|
Enforces that only one checkout hook, and only one command hook, can be run (default: false) |
--no-multipart-artifact-upload #
|
For Buildkite-hosted artifacts, disables the use of multipart uploads. Has no effect on uploads to other destinations such as custom cloud buckets (default: false) |
--artifact-upload-concurrency int #
|
Maximum number of concurrent artifact upload operations used by jobs started by this agent. When unset, artifact uploads use their default (default: 0) |
Agent targeting
Once you've started agents with tags you can target them in the build pipeline using agent query rules.
Here's an example of targeting agents that are running with the tag postgres and value of 1.9.4:
steps:
- command: "script.sh"
agents:
postgres: "1.9.4"
You can also match for any agent with a postgres tag by omitting the value after the = sign, or by using *, for example:
steps:
- command: "script.sh"
agents:
postgres: '*'
Partial wildcard matching (for example, postgres=1.9* or postgres=*1.9) is not yet supported.
Use a top-level agents block to set defaults for all steps in a pipeline.
If you specify multiple tags, your build will only run on agents that have all the specified tags.
The queue tag
The queue tag works differently from other tags, and can be used for isolating jobs and agents. See the Queues overview page for more information about using queues.
If you specify a queue and agent tags, your build will only run on agents that match all of the specified criteria.
For example, if a job has the following agent targeting rules, an agent with both queue=test and postgres=1.9.4 should be present. Otherwise, the job will not dispatch to an agent.
steps:
- command: "script.sh"
agents:
postgres: '1.9.4'
queue: test
Run a job on the agent that uploaded it (also known as node affinity)
You can configure your agent and your pipeline steps so that the steps run on the same agent that performed pipeline upload. This is sometimes referred to as "node affinity", but note that what we describe here does not involve Kubernetes (where the term is more widely used).
First, set the agent hostname tag.
You can do this when starting the agent. This uses the system hostname:
buildkite-agent start --tags "hostname=`hostname`"
Or you can add it to the agent config file, along with any other tags:
tags="hostname=`hostname`"
Then, make sure you are using pipeline upload to upload a pipeline.yml. In Buildkite's YAML steps editor:
steps:
- command: "buildkite-agent pipeline upload"
Finally, in your pipeline.yml, set hostname: "$BUILDKITE_AGENT_META_DATA_HOSTNAME" on any commands that you want to stick to the agent that uploaded the pipeline.yml. For example:
steps:
- command: echo "I will stick!"
agents:
hostname: "$BUILDKITE_AGENT_META_DATA_HOSTNAME"
- command: echo "I might not"
When Buildkite uploads the pipeline, $BUILDKITE_AGENT_META_DATA_HOSTNAME is replaced with the agent's hostname tag value. In effect, the previous example becomes:
steps:
- command: echo "I will stick!"
agents:
hostname: "agents-computer-hostname"
- command: echo "I might not"
This means the first step in the example can only run on an agent with the hostname "agents-computer-hostname". This is the hostname of the agent that uploaded the job. The second step may run on the same agent, or a different one.
Run a single job
--acquire-job value allows you to start an agent and only run the specified job, stopping the agent after it's finished. This means that when you start the agent, instead of it waiting for work, it sends a request to Buildkite to check if it can acquire (self-assign and accept) the job. Once the agent acquires the job, it will run the job, then the agent will be stopped when the job is complete. Jobs acquired using this method will ignore agent tags configured on a job.
Getting the job ID for a single job
value is the job ID. There are several ways to find it:
- Using the Build API's Get a build endpoint. This returns build information, including all jobs in the build.
- Through the GraphQL API.
- The
BUILDKITE_JOB_IDbuild environment variable. - In outbound job event webhooks.
- Using the GUI: select a job, and the job ID is the final value in the URL.
When to use
Normally, you don't set up an agent to run a specific job. Instead, you'll have a pool of agents running, waiting for Buildkite to send jobs to them.
--acquire-job is useful if you want to create your own scheduler to run a specific job.